VULN-DISCLOSURE-POLICY.md: CRLF in data

[bagder]

we reject the idea of CRLF injection by the user itself as a general security problem

[Copilot]

Pull request overview

This PR adds a new section to the vulnerability disclosure policy documenting curl's stance on CRLF injection, clarifying that the ability to send carriage-return (CR) and line-feed (LF) characters is an intentional feature rather than a security vulnerability.

• Adds a "CRLF in data" section explaining curl's policy on handling CRLF sequences
• Explicitly states that CRLF injection is not considered a security problem
• Clarifies that users have control over what data they send through curl

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.